Understanding the Children’s Online Privacy Protection Act

For a decade, the federal government has regulated how websites collect and use personal information from children under 13.

European Pressphoto Agency

The Children’s Online Privacy Protection Act generally prohibits website operators from knowingly collecting personally identifiable information from children under 13 without parental consent. It also requires site operators to collect only personal information that is “reasonably necessary” for an online activity. The law, which was enacted in 1998 and took effect in 2000, says personal information includes a full name, home or e-mail address, telephone number or Social Security number.

The law was intended to give parents control over the information collected from their children online and how that information is used and shared. Mamie Kresses, a senior attorney at the Federal Trade Commission, which enforces the law, says it grew from concerns in the 1990s about websites that used cartoon characters, prizes, and other techniques to encourage children to submit personal or family information without their parents’ knowledge.

The FTC says it actively monitors websites to enforce the law. In 2008, Sony BMG Music Entertainment agreed to pay $1 million to settle FTC charges that it had collected personal information from at least 30,000 children on nearly 200 entertainment sites. Sony BMG, now known as Sony Music Entertainment Inc., did not admit or deny wrongdoing.

State officials have lodged similar charges under their own laws. On Wednesday, Echometrix Inc. agreed to pay $100,000 to settle charges by New York state’s attorney general that it was selling data gleaned from its software that allows parents to monitor their children’s online activities.

The attorney general said Echometrix had violated state deceptive-practices and false-advertising laws. Echometrix, which did not admit or deny wrongdoing, also agreed to stop selling information gathered from children using its monitoring software. Echometrix did not immediately return a call for comment.

Critics say Coppa has many loopholes and is difficult to enforce. In particular, they say, there’s no way to prevent children from lying about their age. The FTC says that kids falsifying their age is a concern, but it doesn’t have statistics about how common it is.

The FTC recommends that sites screen users if they collect personal information and children under 13 could be expected to use the site. The agency recommends that registration forms not alert users to the age cut-off, and that sites restrict users from trying to register multiple times.

Of 50 popular kids and teens sites surveyed by The Wall Street Journal, 18 required users to submit their age while registering, and did not allow children under 13 to register. Fifteen sites allowed children to register, but either did not collect personal information from children or only did so with parent consent. Five sites did not require users to enter their age during registration. And 12 others did not collect personal information from any users.

The FTC is reviewing its rules related to Coppa in light of changes in technology since its last review in 2005.

Jeffrey Chester, director of the Center for Digital Democracy, a Washington nonprofit active on privacy issues, says that the law has succeeded in minimizing data collection from children. But he says the FTC should expand the definition of “personal information” to include online behavioral tracking that captures children’s demographic information, interests and Web-browsing habits. Even without a name or a street address he says, such tracking “provides a digital way of identifying a child.”

Mr. Chester also wants Congress to expand Coppa to include specific protections for teenagers.
Berin Szoka, a fellow at Progress & Freedom Foundation, a Washington, D.C., think tank, says that expanding Coppa to cover teenagers would force many general-interest websites to screen users, hindering free speech. Mr. Szoka says restricting behavioral tracking will lead to “less media, less diversity of content for children, and parents are going to have to pay.”